Home / server / Questions / 299300
Accepted
Aldebaran
Asked: 2011-08-10 08:39:18 +0800 CST

Enforce sshd key algorithm

  • 772

In ssh_config I have the HostKeyAlgorithms parameter where I can enforce the use of DSS algorithm for the key, like:

HostKeyAlgorithms "ssh-dss"

How can I do this in sshd_config (daemon config) in order to enforce that all connections incoming should use the ssh-dss instead of ssh-rsa ?

ssh rsa dsa

2 Answers

  1. Best Answer

    remove 

    HostKey /etc/ssh/ssh_host_rsa_key
    from sshd_config.

    I have to note that using 1024 bit keys with either RSA or DSA is no longer considered secure and standard DSA limits key size to 1024 bits (though OpenSSH can generate DSA keys up to 2048bits)

    • 2

  2. "OpenSSH 7.0 and greater similarly disable the ssh-dss (DSA) public key algorithm. It too is weak and we recommend against its use."

    Source : https://www.openssh.com/legacy.html

    • 0